7dba26d2529748088ba90c7c3b0d374649ac3b2efb2380608b7b5f012993f82a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17279403077f885c827960b6e8c87068d24f6ff15ba15cc4b7b6b413aafc09161cfef75b30571.dat-decoded.exe
Size

482KB
MD5

f055c74729b56c8a7147af1ef0526932
SHA1

8b85b9046049f7c0e8b93b0ba2b9351e58a07f98
SHA256

7dba26d2529748088ba90c7c3b0d374649ac3b2efb2380608b7b5f012993f82a
SHA512

6dc43afa3828e58d808fd792b639de7c96a12991f7336bb755ab22361b7dcc3f931f45988f3cdfba5db84928a61e3df2db53d95802fa6c333ff84d16570c4638
SSDEEP

6144:bTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZmAX4crCT4:bTlrYw1RUh3NFn+N5WfIQIjbs/ZmNT4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17279403077f885c827960b6e8c87068d24f6ff15ba15cc4b7b6b413aafc09161cfef75b30571.dat-decoded.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4680	17279403077f885c827960b6e8c87068d24f6ff15ba15cc4b7b6b413aafc09161cfef75b30571.dat-decoded.exe

C:\Users\Admin\AppData\Local\Temp\17279403077f885c827960b6e8c87068d24f6ff15ba15cc4b7b6b413aafc09161cfef75b30571.dat-decoded.exe
"C:\Users\Admin\AppData\Local\Temp\17279403077f885c827960b6e8c87068d24f6ff15ba15cc4b7b6b413aafc09161cfef75b30571.dat-decoded.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\1210\logs.dat

Filesize
144B

MD5
27d9a96942a4ce15434ba1ce2a5906fe

SHA1
da6b9ae90f813de8024140647249f68c2fcbd35a

SHA256
81a07c5473bed439ac58f9b041235ff3d920733d76bc9839274bf626a3dd5623

SHA512
4ee8ba9dd95201808e9c46e16c4139289c05f1ae6cc59d199531e7e3f9f57bc81317eef4599559172bc0ea2f02d375068941110e7fa50757d7ae0e5795976922

Download Submit